Equifax on Sunday sent notices to people who had filed requests for cash settlements informing them of a required step in order to receive the money.

People seeking the $125compensation must “verify” their claim by providing the name of the credit monitoring service they had in place when they filed it, and the service must remain in place for at least six months after filing. This new step must be completed by October 15, otherwise the claim for the cash compensation will be denied. Alternatively, people can “amend” their claim by signing up for the free credit monitoring service provided by Equifax, forgoing the cash settlement.

The step is for compensation — meant to subsidize outside credit monitoring services people had already paid to put in place — that’s likely to be less than $125 anyway. Equifax was ordered in July by the Federal Trade Commission to pay up to $700 million in individual compensation and civil penalties because of the hack. That meant anyone affected by the breach who already had credit monitoring in place could file a claim to receive cash compensation.

But only $31 million of that total settlement was earmarked for cash payouts, to be distributed among everyone with a valid claim. That money is part of a larger $300 million settlement fund, the rest of which would pay for Equifax’s own free credit monitoring services.

A week after the settlement website went live in late July, millions of people had logged on, prompting the FTC to warn that each individual settlement check is likely to be “nowhere near” the $125 originally promised. The agency urged people affected to take the free credit monitoring offer instead. That service provides 10 years of free credit monitoring: four years via the three major credit bureaus (Equifax, Experian and TransUnion) and six years through Equifax.

Equifax again highlighted this point in the email it sent on Sunday to people who had filed claims.

“Based on the number of potentially valid claims that have been submitted to date, payments of these benefits likely will be substantially lowered,” the company said.

Asking for the name of the credit monitoring agency people asking for a cash payout have been using may be a way of narrowing the group that settlement will be divided between. The company also told people they could be asked for additional information before they receive their payout. Though people’s claims for the $125 will be denied if they do not provide the name of their credit monitoring agencies by October 15, claims for other types of compensation will still be valid.

The Equifax data breach was the largest in history, affecting at least 147 million Americans.